PubkeyAuthentication

PubkeyAuthentication is an SSH authentication method that uses public-key cryptography to verify a user’s identity without requiring a password. In this scheme, the user possesses a private key and the server stores the corresponding public key. When connecting, the server verifies a signature created with the private key, proving the user controls the key pair without exposing sensitive material.

How it works: The user generates a key pair (for example with ssh-keygen) and places the public key in the server’s authorized keys list (typically in ~/.ssh/authorized_keys). During login, the client proves possession of the private key by signing a server-provided challenge. The server checks the signature against the stored public key; a successful verification grants access. Common key types include Ed25519 and ECDSA; RSA remains supported but newer formats are preferred for security and performance. SSH agents can hold private keys to streamline multiple sessions and passphrases protect keys at rest.

Configuration involves both server and client settings. On the server (sshd_config), PubkeyAuthentication yes enables the method, and PasswordAuthentication no can disable password logins for stronger security. The server uses AuthorizedKeysFile to locate public keys, and per-user permissions on ~/.ssh and authorized_keys are important. On the client (ssh_config), PubkeyAuthentication is typically enabled by default, and IdentityFile can specify which private key to use; an SSH agent can be used to manage keys.

Security considerations include protecting private keys with strong passphrases, restricting key usage with options in authorized_keys (such as from, command, no-port-forwarding), and regularly rotating keys. Public-key authentication reduces the risk of brute-force password attacks and is widely used for automated and administrator access, provided proper key management practices are followed.